IKE phase 2 failing with an asa5505

[LCMember1607]

Message =

IKE phase-1 negotiation is succeeded as initiator, main mode. Established SA:

IKE phase-2 negotiation is started as initiator, quick mode. Initiated SA:

IKE protocol notification message received: INVALID-ID-INFORMATION (18).

[gswcowboy · Accepted solution]

Hi,

Confirm we have the correct local and remote proxy Id's from the ASA configured on the PAN.
If we can get the tunnel to be initiated from the ASA the PAN system logs should give us more detail as to the configuration option we need to adjust.

*Proxy id's are needed when building a tunnel to other devices that use policy based VPN, we use route based vpn's

*There would have to be a proxy id entry for each network

Here's an example of PAN to ISA config:

https://live.paloaltonetworks.com/docs/DOC-1328

-Renato   

[dagibbs]

Also, get the ASA5505 administrator to confirm he hasn't done soemthing "funky' with the tunnel name.

There's a "feature" in Cisco firewalls which require the tunnel ID ont he PIX/ASA to be the IP address of the remote end - just the IP address, *not* a name or anything else - or else phase 2 fails.

This one bit me in the backside badly in a past life.

Cheers.

[James]

I have found in previous tests I need to set the exchange mode to aggressive mode.

Then, even though aggressive mode expects the IP address as the authentication, Cisco will send an FQDN instead.

This command might give you some more info :

less mp-log ikemgr.log (see whole log)

tail mp-log ikemgr.log (go to end of log)

tail follow yes mp-log ikemgr.log (show log in real time)

There are further CLI commands to check the VPN status in the VPN config/tech note docs.

Thanks

James

[LCMember1607]

Thanks, I set up the proxies and the tunnel is up.

Now I think I may have a nat issue.

Any NAT configs on hand for asa<->pan?

Thanks.

[leole]

Hi Bill,

How did you set up the proxies? I got the same error between PAN4020 and ASA5510

Thanks.

Leo

lle@socccd.edu

[LCMember1607]

IPSec tunnel.

Show advanced options

select the correct IKE Gateway, under IPSec Crypto Profile add a Proxy ID with the Local ID  being either a subnet or device IP that you are allowing access to on the PAN side and a Remote ID being either a subnet or device IP on the ASA side.

[friento]

FYI

There's limit of 10 Proxy per tunnel.

[leole]

Thank you  Bill,

It works for me.

Leo